Breach Disclosure: Wongnai

A Thailand based hospitality and restaurant discovery service suffered a data breach earlier this year, impacting millions of customers. This breach was published for sale on a popular hacker forum by a data broker along with other breached databases. The leaked data contains names, phone numbers, social media IDs and MD5 password hashes.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

Hackers have stolen the customer data belonging to Wongnai and posted it for sale on a popular hacker forum via a data broker under the alias of ExpertData. The price is undisclosed and marked as "Limited sales" in order to drive interest. There is currently no indication as to how this data was obtained but the leak contains 4.3 million records of customer information. Wongnai have acknowledged the data leak and have confirmed that impacted customers have been contacted via email.

imgur
Figure 1: Wongnai database advertised for sale on a popular hacker forum.

The leaked information includes:

Full name
Phone number
Email addresses
Passwords (md5 hashed)
Facebook ID's
Twitter ID's
Google ID's
Zip codes
Gender
Date of birth
IP Addresses

imgur
Figure 2: Sample data obtained by Alpha Team containing customer PII.

The author of the thread, ExpertData, has previously sold other databases on the hacker forum targeting GoNitro and HelloTravel and has also obtained a reputabe data broker status within the community.

imgur
Figure 3: Other threads from ExpertData.